Full Report
Today is Microsoft's June 2026 Patch Tuesday, with security updates for 200 flaws, including five publicly disclosed zero-day vulnerabilities and one actively exploited in attacks. [...]
Analysis Summary
# Vulnerability: Microsoft June 2026 Patch Tuesday Cumulative Update
## CVE Details
- **CVE ID:** CVE-2026-45586 (GreenPlasma), CVE-2026-49160 (HTTP/2 Bomb), CVE-2026-45585 (YellowKey), and others.
- **CVSS Score:** Varies; 33 classified as **Critical**.
- **CWE:** CWE-59 (Improper Link Resolution), CWE-400 (Uncontrolled Resource Consumption), and others.
## Affected Systems
- **Products:** Windows OS (10, 11), Windows Server, HTTP.sys, Windows Telephony Service, Win32K Graphics Component, UEFI Secure Boot.
- **Versions:** Windows 11 (KB5094126, KB5093998), Windows 10 (KB5094127), and various Server editions.
- **Configurations:** Systems utilizing HTTP/2 protocol for web services and environments using CTFMON or UEFI Secure Boot.
## Vulnerability Description
This patch cycle addresses 200 flaws. Notable technical issues include:
- **CVE-2026-45586 (CTFMON):** An improper link resolution error in the Collaborative Translation Framework that allows attackers to follow symlinks to sensitive files or processes.
- **CVE-2026-49160 (HTTP/2 Bomb):** A DoS flaw where small, malicious header frames force the server to allocate massive amounts of memory, leading to resource exhaustion.
- **RCE Flaws:** 28 critical Remote Code Execution vulnerabilities, specifically in the Windows Graphics Component (CVE-2026-44812, CVE-2026-44803).
## Exploitation
- **Status:** **Exploited in the wild** (one undisclosed zero-day) and **Publicly Disclosed** (five zero-days including GreenPlasma and HTTP/2 Bomb).
- **Complexity:** Low to Medium.
- **Attack Vector:** Varies (Local for Elevation of Privilege; Network for RCE and DoS).
## Impact
- **Confidentiality:** High (Information disclosure and full SYSTEM access via EoP).
- **Integrity:** High (Unauthorized privilege escalation and code execution).
- **Availability:** High (Denial of Service via resource exhaustion).
## Remediation
### Patches
- **Windows 11:** Install KB5094126 or KB5093998.
- **Windows 10:** Install KB5094127 (Extended Security Update).
- **General:** Apply June 2026 security updates via Windows Update or WSUS.
### Workarounds
- **HTTP/2 DoS Mitigation:** Implement the new "MaxHeadersCount" registry setting to limit the number of headers accepted in a single request.
- **UEFI:** Ensure Secure Boot is configured and physical access to devices is restricted to prevent bypasses.
## Detection
- **Indicators of Compromise:** Unexpected elevation of processes to SYSTEM level; abnormal memory spikes in HTTP.sys/IIS services.
- **Detection methods and tools:** Use SIEM/EDR rules to monitor for "link following" behavior and unusual resource allocation patterns. Verify patch compliance using Microsoft Defender Vulnerability Management.
## References
- Microsoft Security Update Guide: hxxps[://]msrc[.]microsoft[.]com/update-guide/
- Windows 11 Cumulative Update: hxxps[://]www[.]bleepingcomputer[.]com/news/microsoft/windows-11-kb5094126-and-kb5093998-cumulative-updates-released/
- Zero-day definitions: hxxps[://]learn[.]microsoft[.]com/en-us/defender-vulnerability-management/tvm-zero-day-vulnerabilities